CVE-2015-0231

Description

Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5 allows remote attackers to execute arbitrary code via a crafted unserialize call that leverages improper handling of duplicate numerical keys within the serialized properties of an object. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-8142.

Risk Information

Base Score

9.8

MODERATE

Vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score

Exploitation Probability

87.284

Associated Vulnerability

Vulnerability	OS Platform
Multiple vulnerabilities are fixed in OS X El Capitan 10.11.6 Update	Mac
Multiple vulnerabilities are fixed in OS X El Capitan 10.11.6 Combo Update	Mac
Multiple vulnerabilities are fixed in OS X El Capitan 10.11.5 Update	Mac
Multiple vulnerabilities are fixed in OS X El Capitan 10.11.5 Combo Update	Mac
Multiple vulnerabilities are fixed in OS X El Capitan 10.11.4 Update	Mac
Multiple vulnerabilities are fixed in OS X El Capitan 10.11.4 Combo Update	Mac
Multiple vulnerabilities are fixed in OS X El Capitan 10.11.3 Update	Mac
Multiple vulnerabilities are fixed in OS X El Capitan 10.11.2 Update	Mac
Multiple vulnerabilities are fixed in OS X El Capitan 10.11.1 Update	Mac

Patch Details

Click to see the patches provided by ManageEngine for this CVE

Patch ID	Patch Description
PATCH-600753	OS X El Capitan 10.11.6 Update
PATCH-600754	OS X El Capitan 10.11.6 Combo Update
PATCH-600753	OS X El Capitan 10.11.6 Update
PATCH-600754	OS X El Capitan 10.11.6 Combo Update
PATCH-600753	OS X El Capitan 10.11.6 Update
PATCH-600754	OS X El Capitan 10.11.6 Combo Update
PATCH-600753	OS X El Capitan 10.11.6 Update
PATCH-600753	OS X El Capitan 10.11.6 Update
PATCH-600753	OS X El Capitan 10.11.6 Update

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234